mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-10-02 08:51:44 +00:00
test(openeuler): exercise logging and host-key postscripts
This commit is contained in:
Vinícius Ferrão
@@ -0,0 +1,151 @@
|
||||
#!/usr/bin/env perl
|
||||
use strict;
|
||||
use warnings;
|
||||
use Cwd qw(abs_path);
|
||||
use Digest::SHA qw(sha256_hex);
|
||||
use File::Copy qw(copy);
|
||||
use File::Path qw(make_path);
|
||||
use File::Temp qw(tempdir);
|
||||
use FindBin;
|
||||
use Test::More;
|
||||
|
||||
plan skip_all => 'requires Linux root and mount namespaces' unless $^O eq 'linux' && $> == 0;
|
||||
plan skip_all => 'mount namespaces unavailable' if system('unshare -m -- true >/dev/null 2>&1');
|
||||
plan skip_all => 'requires native ssh-keygen' unless -x '/usr/bin/ssh-keygen';
|
||||
my $source = $ENV{XCAT_HOSTKEY_SOURCE_ROOT} || abs_path("$FindBin::Bin/../..");
|
||||
my $tmp = tempdir(DIR => '/var/tmp', CLEANUP => 1);
|
||||
chmod 0700, $tmp;
|
||||
make_path("$tmp/keys", "$tmp/bin");
|
||||
|
||||
sub write_file {
|
||||
my ($path, $contents) = @_;
|
||||
open(my $fh, '>', $path) or die "$path: $!";
|
||||
print {$fh} $contents;
|
||||
close($fh) or die "$path: $!";
|
||||
}
|
||||
sub read_file {
|
||||
my ($path) = @_;
|
||||
return '' unless -f $path;
|
||||
open(my $fh, '<', $path) or die "$path: $!";
|
||||
local $/;
|
||||
return <$fh> // '';
|
||||
}
|
||||
sub public_identity {
|
||||
my ($path) = @_;
|
||||
my @fields = split /\s+/, read_file($path);
|
||||
return join(' ', @fields[0, 1]) if @fields >= 2;
|
||||
return '';
|
||||
}
|
||||
|
||||
my @types = qw(dsa rsa ecdsa ed25519);
|
||||
for my $type (@types) {
|
||||
my $rc = system('/usr/bin/ssh-keygen', '-q', '-t', $type, '-f', "$tmp/keys/$type", '-N', '', '-C', '');
|
||||
BAIL_OUT("native ssh-keygen cannot generate disposable $type fixture") if $rc;
|
||||
}
|
||||
for my $name (qw(remoteshell xcatlib.sh remoteshell-sshd-config)) {
|
||||
copy("$source/xCAT/postscripts/$name", "$tmp/bin/$name") or die $!;
|
||||
chmod 0755, "$tmp/bin/$name";
|
||||
}
|
||||
write_file("$tmp/bin/namespace", <<'SH');
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mount --make-rprivate /
|
||||
mount --bind "$XCAT_KEY_FIXTURE/etc" /etc
|
||||
mount --bind "$XCAT_KEY_FIXTURE/root" /root
|
||||
mount --bind "$XCAT_KEY_FIXTURE/tmp" /tmp
|
||||
exec "$@"
|
||||
SH
|
||||
write_file("$tmp/bin/getcredentials.awk", <<'SH');
|
||||
#!/bin/bash
|
||||
case "$1" in
|
||||
ssh_dsa_hostkey) cat "$XCAT_KEY_INPUT/dsa" ;;
|
||||
ssh_rsa_hostkey) cat "$XCAT_KEY_INPUT/rsa" ;;
|
||||
ssh_ecdsa_hostkey) cat "$XCAT_KEY_INPUT/ecdsa" ;;
|
||||
ssh_ed25519_hostkey) cat "$XCAT_KEY_INPUT/ed25519" ;;
|
||||
ssh_root_pub_key) cat "$XCAT_KEY_INPUT/rsa.pub" ;;
|
||||
*) printf '<error>unexpected credential request</error>\n'; exit 1 ;;
|
||||
esac
|
||||
SH
|
||||
write_file("$tmp/bin/allowcred.awk", "#!/bin/sh\nexec /bin/sleep 60\n");
|
||||
write_file("$tmp/bin/logger", "#!/bin/sh\nprintf '%s\\n' \"\$*\" >> \"\$XCAT_KEY_FIXTURE/logger.log\"\n");
|
||||
write_file("$tmp/bin/systemctl", "#!/bin/sh\nprintf '%s\\n' \"\$*\" >> \"\$XCAT_KEY_FIXTURE/services.log\"\nexit 0\n");
|
||||
write_file("$tmp/bin/sleep", "#!/bin/sh\nexit 0\n");
|
||||
for my $command (qw(chown chmod)) {
|
||||
write_file("$tmp/bin/$command", "#!/bin/bash\n" .
|
||||
'if [ "$XCAT_KEY_FAIL_COMMAND" = "${0##*/}" ] && [[ "${!#}" = "/etc/ssh/ssh_host_${XCAT_KEY_FAIL_TYPE}_key" ]]; then exit 42; fi' . "\n" .
|
||||
'exec /usr/bin/' . $command . ' "$@"' . "\n");
|
||||
}
|
||||
for my $name (qw(namespace getcredentials.awk allowcred.awk logger systemctl sleep chown chmod)) {
|
||||
chmod 0755, "$tmp/bin/$name";
|
||||
}
|
||||
|
||||
for my $case (
|
||||
['native fresh', 'openeuler24.03sp3', 'openEuler', 1, 0],
|
||||
['native existing', 'openeuler20.03sp4', 'openEuler', 1, 1],
|
||||
['native no ssh_keys group', 'openeuler24.03', 'openEuler', 0, 1],
|
||||
['native os-release fallback', '', 'openEuler', 1, 1],
|
||||
['legacy with ssh_keys group', 'rhels9.6', 'rhel', 1, 0],
|
||||
['legacy without ssh_keys group', 'rhels9.6', 'rhel', 0, 0],
|
||||
['native chmod failure', 'openeuler24.03sp3', 'openEuler', 1, 1, 'chmod', 'dsa'],
|
||||
['native chown failure', 'openeuler24.03sp3', 'openEuler', 1, 1, 'chown', 'ed25519'],
|
||||
) {
|
||||
my ($label, $osver, $id, $group, $existing, $fail_command, $fail_type) = @$case;
|
||||
my $fixture = tempdir(DIR => $tmp, CLEANUP => 1);
|
||||
make_path(map { "$fixture/$_" } qw(etc/ssh root tmp));
|
||||
write_file("$fixture/etc/passwd", "root:x:0:0:root:/root:/bin/bash\n");
|
||||
write_file("$fixture/etc/group", "root:x:0:\n" . ($group ? "ssh_keys:x:4242:\n" : ''));
|
||||
write_file("$fixture/etc/nsswitch.conf", "passwd: files\ngroup: files\n");
|
||||
write_file("$fixture/etc/os-release", "ID=$id\n");
|
||||
write_file("$fixture/etc/ssh/sshd_config", "Port 22\n");
|
||||
write_file("$fixture/etc/ssh/ssh_config", "Host *\n");
|
||||
for my $type (@types) {
|
||||
next unless $existing;
|
||||
my $key = "$fixture/etc/ssh/ssh_host_${type}_key";
|
||||
copy("$tmp/keys/$type", $key) or die $!;
|
||||
chmod 0640, $key;
|
||||
chown 0, 4242, $key;
|
||||
}
|
||||
for my $run (1, 2) {
|
||||
my $output;
|
||||
my $rc;
|
||||
{
|
||||
local %ENV = (%ENV, PATH => "$tmp/bin:/usr/bin:/bin:/usr/sbin:/sbin",
|
||||
OSVER => $osver, MASTER => '192.0.2.1', USEFLOWCONTROL => 'NO',
|
||||
NTYPE => 'compute', ENABLESSHBETWEENNODES => 'NO', NODESETSTATE => 'netboot',
|
||||
SECUREROOT => '0', ZONENAME => '', XCAT_KEY_FIXTURE => $fixture,
|
||||
XCAT_KEY_INPUT => "$tmp/keys", XCAT_SSH_ETC => '/etc/ssh',
|
||||
XCAT_KEY_FAIL_COMMAND => $fail_command || '', XCAT_KEY_FAIL_TYPE => $fail_type || '');
|
||||
open(my $pipe, '-|', 'sh', '-c', 'exec "$@" 2>&1', 'sh',
|
||||
'unshare', '-m', '--', "$tmp/bin/namespace", "$tmp/bin/remoteshell") or die $!;
|
||||
$output = do { local $/; <$pipe> };
|
||||
close($pipe);
|
||||
$rc = $? >> 8;
|
||||
}
|
||||
if ($fail_command) {
|
||||
is($rc, 1, "$label run $run reports failed key protection");
|
||||
like(read_file("$fixture/logger.log"), qr/failed to secure .*ssh_host_${fail_type}_key/, "$label run $run identifies the failed key");
|
||||
ok(!-e "$fixture/etc/ssh/ssh_host_${fail_type}_key.pub", "$label run $run stops before public key derivation");
|
||||
is(read_file("$fixture/services.log"), '', "$label run $run stops before service restart");
|
||||
next;
|
||||
}
|
||||
is($rc, 0, "$label run $run completes the full postscript");
|
||||
my $native = $id eq 'openEuler';
|
||||
if ($native || !$group) {
|
||||
unlike($output, qr/UNPROTECTED PRIVATE KEY|bad permissions/, "$label run $run has no permission rejection");
|
||||
for my $type (@types) {
|
||||
my $key = "$fixture/etc/ssh/ssh_host_${type}_key";
|
||||
is(sha256_hex(read_file($key)), sha256_hex(read_file("$tmp/keys/$type")), "$label run $run preserves provisioned $type identity");
|
||||
is(sha256_hex(public_identity("$key.pub")), sha256_hex(public_identity("$tmp/keys/$type.pub")), "$label run $run derives the matching $type public key");
|
||||
my @private = stat($key);
|
||||
my @public = stat("$key.pub");
|
||||
is_deeply([defined($private[2]) ? $private[2] & 0777 : undef, @private[4,5]], [0600, 0, 0], "$label run $run $type private ownership and mode");
|
||||
is_deeply([defined($public[2]) ? $public[2] & 0777 : undef, $public[4]], [0644, 0], "$label run $run $type public ownership and mode");
|
||||
}
|
||||
} else {
|
||||
my @rsa = stat("$fixture/etc/ssh/ssh_host_rsa_key");
|
||||
is_deeply([$rsa[2] & 0777, @rsa[4,5]], [0640, 0, 4242], "$label run $run retains the legacy permission chain");
|
||||
}
|
||||
like(read_file("$fixture/services.log"), qr/^restart sshd(?:\.service)?$/m, "$label run $run reaches the service command boundary");
|
||||
}
|
||||
}
|
||||
done_testing();
|
||||
@@ -0,0 +1,179 @@
|
||||
#!/usr/bin/env perl
|
||||
use strict;
|
||||
use warnings;
|
||||
use Cwd qw(abs_path);
|
||||
use File::Copy qw(copy);
|
||||
use File::Path qw(make_path);
|
||||
use File::Temp qw(tempdir);
|
||||
use FindBin;
|
||||
use Test::More;
|
||||
|
||||
plan skip_all => 'requires Linux root and mount/network namespaces' unless $^O eq 'linux' && $> == 0;
|
||||
plan skip_all => 'namespaces unavailable' if system('unshare -mn -- true >/dev/null 2>&1');
|
||||
plan skip_all => 'requires native rsyslogd, logger, ip and ss'
|
||||
if system('command -v rsyslogd logger ip ss >/dev/null');
|
||||
my $source = $ENV{XCAT_SYSLOG_SOURCE_ROOT} || abs_path("$FindBin::Bin/../..");
|
||||
my $tmp = tempdir(DIR => '/var/tmp', CLEANUP => !$ENV{XCAT_SYSLOG_KEEP});
|
||||
diag("fixtures: $tmp") if $ENV{XCAT_SYSLOG_KEEP};
|
||||
make_path("$tmp/bin");
|
||||
sub write_file {
|
||||
my ($path, $contents) = @_;
|
||||
open(my $fh, '>', $path) or die "$path: $!";
|
||||
print {$fh} $contents;
|
||||
close($fh) or die "$path: $!";
|
||||
}
|
||||
sub read_file {
|
||||
my ($path) = @_;
|
||||
return '' unless -f $path;
|
||||
open(my $fh, '<', $path) or die "$path: $!";
|
||||
local $/;
|
||||
return <$fh> // '';
|
||||
}
|
||||
for my $name (qw(syslog xcatlib.sh)) {
|
||||
copy("$source/xCAT/postscripts/$name", "$tmp/bin/$name") or die $!;
|
||||
}
|
||||
write_file("$tmp/bin/systemctl", <<'SH');
|
||||
#!/bin/bash
|
||||
printf '%s\n' "$*" >> "$XCAT_SYSLOG_FIXTURE/services.log"
|
||||
[ "$XCAT_SYSLOG_FAIL" = restart ] && exit 42
|
||||
[ "$1" = restart ] || exit 43
|
||||
if [ -s /run/rsyslog-test.pid ]; then
|
||||
kill "$(cat /run/rsyslog-test.pid)"
|
||||
for i in {1..50}; do [ -f /run/rsyslog-test.pid ] || break; sleep .1; done
|
||||
fi
|
||||
exec /usr/sbin/rsyslogd -i /run/rsyslog-test.pid -f /etc/rsyslog.conf
|
||||
SH
|
||||
write_file("$tmp/bin/logger", <<'SH');
|
||||
#!/bin/bash
|
||||
printf '%s\n' "$*" >> "$XCAT_SYSLOG_FIXTURE/logger.log"
|
||||
SH
|
||||
write_file("$tmp/bin/namespace", <<'SH');
|
||||
#!/bin/bash
|
||||
set -eu
|
||||
mount --make-rprivate /
|
||||
mount --bind "$XCAT_SYSLOG_FIXTURE/etc" /etc
|
||||
mount --bind "$XCAT_SYSLOG_FIXTURE/log" /var/log
|
||||
mount --bind "$XCAT_SYSLOG_FIXTURE/run" /run
|
||||
mount --bind "$XCAT_SYSLOG_FIXTURE/state" /var/lib/rsyslog
|
||||
ip link set lo up
|
||||
trap 'for f in /run/*pid; do [ ! -f "$f" ] || kill "$(cat "$f")" 2>/dev/null || :; done' EXIT
|
||||
/usr/sbin/rsyslogd -i /run/upstream.pid -f "$XCAT_SYSLOG_FIXTURE/upstream.conf"
|
||||
for pass in 1 2; do
|
||||
set +e
|
||||
bash "$XCAT_SYSLOG_BIN/syslog" > "$XCAT_SYSLOG_FIXTURE/postscript-$pass.log" 2>&1
|
||||
rc=$?
|
||||
set -e
|
||||
echo "$rc" > "$XCAT_SYSLOG_FIXTURE/postscript-$pass.rc"
|
||||
cp /etc/rsyslog.conf "$XCAT_SYSLOG_FIXTURE/config-$pass"
|
||||
cp /etc/rsyslog.d/remote.conf "$XCAT_SYSLOG_FIXTURE/remote-$pass" 2>/dev/null || :
|
||||
[ "$rc" -eq 0 ] || break
|
||||
done
|
||||
set +e
|
||||
/usr/sbin/rsyslogd -N1 -f /etc/rsyslog.conf > "$XCAT_SYSLOG_FIXTURE/parser.log" 2>&1
|
||||
echo "$?" > "$XCAT_SYSLOG_FIXTURE/parser.rc"
|
||||
set -e
|
||||
ss -H -lun 'sport = :514' > "$XCAT_SYSLOG_FIXTURE/udp-514"
|
||||
ss -H -ltn 'sport = :514' > "$XCAT_SYSLOG_FIXTURE/tcp-514"
|
||||
if [ -s "$XCAT_SYSLOG_FIXTURE/udp-514" ]; then
|
||||
/usr/bin/logger -n 127.0.0.1 -P 514 -d -t xcat-syslog-test 'xcat-native-udp-proof'
|
||||
fi
|
||||
if [ -s "$XCAT_SYSLOG_FIXTURE/tcp-514" ]; then
|
||||
/usr/bin/logger -n 127.0.0.1 -P 514 -T -t xcat-syslog-test 'xcat-native-tcp-proof'
|
||||
fi
|
||||
if [ "$XCAT_SYSLOG_ROLE" = cn ]; then
|
||||
/usr/bin/logger -n 127.0.0.1 -P 1515 -d -t xcat-syslog-test 'xcat-native-cn-proof'
|
||||
fi
|
||||
for i in {1..30}; do
|
||||
if [ "$XCAT_SYSLOG_ROLE" = cn ]; then
|
||||
grep -q xcat-native-cn-proof /var/log/upstream 2>/dev/null && break
|
||||
else
|
||||
grep -q xcat-native-tcp-proof /var/log/messages /var/log/upstream 2>/dev/null && break
|
||||
fi
|
||||
sleep .1
|
||||
done
|
||||
SH
|
||||
chmod 0755, "$tmp/bin/$_" for qw(systemctl logger namespace);
|
||||
my $default = read_file('/etc/rsyslog.conf');
|
||||
my $minimal = "global(workDirectory=\"/var/lib/rsyslog\")\ninclude(file=\"/etc/rsyslog.d/*.conf\" mode=\"optional\")\n*.info /var/log/messages\n";
|
||||
my $modern = "module(\n load=\"imudp\"\n)\ninput(\n address=\"127.0.0.1\"\n port=\"514\"\n type=\"imudp\"\n)\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" address=\"127.0.0.1\" port=\"514\")\n";
|
||||
my $legacy = "\$ModLoad imudp\n\$UDPServerRun 514\n\$ModLoad imtcp\n\$InputTCPServerRun 514\n";
|
||||
my @cases = (
|
||||
['native default MN', 'mn', 'openeuler24.03', $default],
|
||||
['native default SN local', 'snlocal', 'openeuler24.03', $default],
|
||||
['native default SN forwarding', 'snforward', 'openeuler24.03', $default],
|
||||
['native CN forwarding', 'cn', 'openeuler24.03', $minimal],
|
||||
['native os-release fallback', 'mn', '', $minimal],
|
||||
['native nested modern admin', 'mn', 'openeuler24.03', $minimal, $modern],
|
||||
['native same-line admin', 'mn', 'openeuler24.03', $minimal, "module(load=\"imudp\") input(type=\"imudp\" port=\"514\")\nmodule(load=\"imtcp\") input(type=\"imtcp\" port=\"514\")\n"],
|
||||
['native quoted close admin', 'mn', 'openeuler24.03', $minimal, "module(load=\"imudp\")\ninput(type=\"imudp\" name=\"admin)receiver\" port=\"514\")\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" port=\"514\")\n"],
|
||||
['native quoted attribute data', 'mn', 'openeuler24.03', $minimal, "module(load=\"imudp\")\ninput(type=\"imudp\" name=\"type='imudp',port='514'\" port=\"1515\")\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" port=\"514\")\n"],
|
||||
['native legacy admin', 'snlocal', 'openeuler24.03', $minimal, $legacy],
|
||||
['native module without listener', 'mn', 'openeuler24.03', $minimal, "module(load=\"imudp\")\nmodule(load=\"imtcp\")\n"],
|
||||
['native commented admin', 'mn', 'openeuler24.03', $minimal, join('', map { "#$_\n" } split /\n/, $modern)],
|
||||
['native block comments', 'mn', 'openeuler24.03', $minimal, "/*\n$modern*/\n"],
|
||||
['legacy commented examples', 'mn', 'rhels9.6', $minimal . join('', map { "#$_\n" } split /\n/, $legacy)],
|
||||
['legacy no examples', 'mn', 'rhels9.6', $minimal],
|
||||
['native invalid configuration', 'mn', 'openeuler24.03', $minimal . "invalid_rsyslog_directive()\n", '', 'parser'],
|
||||
['native restart failure', 'mn', 'openeuler24.03', $minimal, '', 'restart'],
|
||||
);
|
||||
my $number = 0;
|
||||
for my $case (@cases) {
|
||||
my ($name, $role, $osver, $config, $admin, $failure) = @$case;
|
||||
$admin //= ''; $failure //= '';
|
||||
my $fixture = "$tmp/" . ++$number;
|
||||
make_path(map { "$fixture/$_" } qw(etc/rsyslog.d etc/admin log run state));
|
||||
write_file("$fixture/etc/os-release", 'ID="' . ($osver =~ /^rhels/ ? 'rhel' : 'openEuler') . "\"\n");
|
||||
write_file("$fixture/etc/xCATMN", '') if $role eq 'mn';
|
||||
if ($admin ne '') {
|
||||
write_file("$fixture/etc/rsyslog.d/admin.conf", "include(file=\"/etc/admin/receiver.conf\")\n");
|
||||
write_file("$fixture/etc/admin/receiver.conf", $admin);
|
||||
}
|
||||
if ($role eq 'cn') {
|
||||
write_file("$fixture/etc/rsyslog.d/admin.conf", "module(load=\"imudp\")\ninput(type=\"imudp\" port=\"1515\")\n");
|
||||
}
|
||||
write_file("$fixture/etc/rsyslog.conf", $config);
|
||||
write_file("$fixture/upstream.conf", "module(load=\"imudp\")\ninput(type=\"imudp\" port=\"1514\")\n*.* /var/log/upstream\n");
|
||||
local %ENV = (%ENV, PATH => "$tmp/bin:$ENV{PATH}", XCAT_SYSLOG_FIXTURE => $fixture,
|
||||
XCAT_SYSLOG_BIN => "$tmp/bin", XCAT_SYSLOG_FAIL => $failure, XCAT_SYSLOG_ROLE => $role,
|
||||
OSVER => $osver, NTYPE => ($role =~ /^sn/ ? 'service' : 'compute'),
|
||||
SVLOGLOCAL => ($role eq 'snlocal' ? 1 : 0), MASTER => '127.0.0.1:1514', SYSLOG => '');
|
||||
is(system('unshare', '-mn', '--', "$tmp/bin/namespace"), 0, "$name: isolated driver completed");
|
||||
my $rc = read_file("$fixture/postscript-1.rc");
|
||||
chomp $rc;
|
||||
if ($failure) {
|
||||
isnt($rc, 0, "$name: failure reaches postscript exit");
|
||||
is(read_file("$fixture/logger.log"), '', "$name: no success log");
|
||||
is(read_file("$fixture/services.log"), '', "$name: invalid configuration is not restarted") if $failure eq 'parser';
|
||||
next;
|
||||
}
|
||||
is($rc, 0, "$name: first postscript succeeds");
|
||||
my $repeat = read_file("$fixture/postscript-2.rc");
|
||||
chomp $repeat;
|
||||
is($repeat, 0, "$name: repeat succeeds");
|
||||
is(read_file("$fixture/config-2"), read_file("$fixture/config-1"), "$name: main configuration is repeatable");
|
||||
is(read_file("$fixture/remote-2"), read_file("$fixture/remote-1"), "$name: forwarding configuration is repeatable");
|
||||
is(0 + read_file("$fixture/parser.rc"), 0, "$name: native parser accepts result");
|
||||
is(read_file("$fixture/etc/admin/receiver.conf"), $admin, "$name: administrator include preserved");
|
||||
if ($name =~ /^native (nested modern|same-line|quoted close|legacy) admin$/) {
|
||||
unlike(read_file("$fixture/config-2"), qr/^(?:module|input)\(/m,
|
||||
"$name: existing administrator receivers need no duplicate declarations");
|
||||
}
|
||||
my $receives = $role ne 'cn' && $name ne 'legacy no examples';
|
||||
for my $protocol (qw(udp tcp)) {
|
||||
is(!!length(read_file("$fixture/$protocol-514")), !!$receives, "$name: $protocol listener matches role");
|
||||
if ($receives) {
|
||||
my $destination = $role eq 'snforward' ? 'upstream' : 'messages';
|
||||
like(read_file("$fixture/log/$destination"), qr/xcat-native-$protocol-proof/, "$name: real $protocol traffic reaches $destination");
|
||||
}
|
||||
}
|
||||
if ($role eq 'cn') {
|
||||
like(read_file("$fixture/log/upstream"), qr/xcat-native-cn-proof/, "$name: real CN traffic forwards");
|
||||
}
|
||||
my $remote = read_file("$fixture/etc/rsyslog.d/remote.conf");
|
||||
if ($role eq 'cn' || $role eq 'snforward') {
|
||||
like($remote, qr/^\*\.\* \@127\.0\.0\.1:1514$/m, "$name: master forwarding retained");
|
||||
} else {
|
||||
unlike($remote, qr/^\*\.\* \@/m, "$name: local logs are not forwarded");
|
||||
}
|
||||
}
|
||||
done_testing();
|
||||
@@ -0,0 +1,116 @@
|
||||
#!/usr/bin/env perl
|
||||
use strict;
|
||||
use warnings;
|
||||
use Cwd qw(abs_path);
|
||||
use File::Copy qw(copy);
|
||||
use File::Path qw(make_path);
|
||||
use File::Temp qw(tempdir);
|
||||
use FindBin;
|
||||
use Test::More;
|
||||
|
||||
plan skip_all => 'requires Linux root and mount/network namespaces' unless $^O eq 'linux' && $> == 0;
|
||||
plan skip_all => 'namespaces unavailable' if system('unshare -mn -- true >/dev/null 2>&1');
|
||||
plan skip_all => 'requires native rsyslogd, systemctl, systemd-detect-virt and chroot'
|
||||
if system('command -v rsyslogd systemctl systemd-detect-virt chroot >/dev/null');
|
||||
my $source = $ENV{XCAT_SYSLOG_SOURCE_ROOT} || abs_path("$FindBin::Bin/../..");
|
||||
my $tmp = tempdir(DIR => '/var/tmp', CLEANUP => !$ENV{XCAT_SYSLOG_KEEP});
|
||||
diag("fixtures: $tmp") if $ENV{XCAT_SYSLOG_KEEP};
|
||||
make_path("$tmp/bin");
|
||||
sub write_file {
|
||||
my ($path, $text) = @_;
|
||||
open(my $fh, '>', $path) or die "$path: $!";
|
||||
print {$fh} $text;
|
||||
close($fh) or die "$path: $!";
|
||||
}
|
||||
sub read_file {
|
||||
my ($path) = @_;
|
||||
return '' unless -f $path;
|
||||
open(my $fh, '<', $path) or die "$path: $!";
|
||||
local $/;
|
||||
return <$fh> // '';
|
||||
}
|
||||
for my $name (qw(syslog xcatlib.sh)) {
|
||||
copy("$source/xCAT/postscripts/$name", "$tmp/bin/$name") or die $!;
|
||||
}
|
||||
write_file("$tmp/bin/systemctl", <<'SH');
|
||||
#!/bin/bash
|
||||
printf '%s\n' "$*" >> "/evidence/services-$XCAT_SYSLOG_PHASE.log"
|
||||
/usr/bin/systemctl "$@" > "/evidence/systemctl-$XCAT_SYSLOG_PHASE.log" 2>&1
|
||||
rc=$?
|
||||
echo "$rc" > "/evidence/systemctl-$XCAT_SYSLOG_PHASE.rc"
|
||||
cat "/evidence/systemctl-$XCAT_SYSLOG_PHASE.log"
|
||||
exit "$rc"
|
||||
SH
|
||||
write_file("$tmp/bin/logger", <<'SH');
|
||||
#!/bin/bash
|
||||
printf '%s\n' "$*" >> /evidence/logger.log
|
||||
SH
|
||||
write_file("$tmp/bin/run", <<'SH');
|
||||
#!/bin/bash
|
||||
set -eu
|
||||
mount --make-rprivate /
|
||||
root="$XCAT_SYSLOG_FIXTURE/root"
|
||||
for path in usr bin sbin lib lib64; do
|
||||
[ -d "/$path" ] || continue
|
||||
mount --bind "/$path" "$root/$path"
|
||||
mount -o remount,bind,ro "$root/$path"
|
||||
done
|
||||
mount --bind "$XCAT_SYSLOG_BIN" "$root/postscripts"
|
||||
mount -o remount,bind,ro "$root/postscripts"
|
||||
mount --bind "$XCAT_SYSLOG_FIXTURE/evidence" "$root/evidence"
|
||||
mount -t proc -o ro proc "$root/proc"
|
||||
mount -t tmpfs -o mode=755,nosuid tmpfs "$root/dev"
|
||||
touch "$root/dev/null"
|
||||
mount --bind /dev/null "$root/dev/null"
|
||||
set +e
|
||||
chroot "$root" /usr/bin/systemd-detect-virt --quiet --chroot > "$XCAT_SYSLOG_FIXTURE/evidence/detect.log" 2>&1
|
||||
echo "$?" > "$XCAT_SYSLOG_FIXTURE/evidence/detect.rc"
|
||||
chroot "$root" /usr/bin/env PATH=/postscripts:/usr/sbin:/usr/bin:/sbin:/bin XCAT_SYSLOG_PHASE=baseline \
|
||||
/bin/bash -c '. /postscripts/xcatlib.sh; restartservice syslog' > "$XCAT_SYSLOG_FIXTURE/evidence/helper.log" 2>&1
|
||||
echo "$?" > "$XCAT_SYSLOG_FIXTURE/evidence/helper.rc"
|
||||
for pass in 1 2; do
|
||||
chroot "$root" /usr/bin/env PATH=/postscripts:/usr/sbin:/usr/bin:/sbin:/bin XCAT_SYSLOG_PHASE=postscript \
|
||||
/bin/bash /postscripts/syslog > "$XCAT_SYSLOG_FIXTURE/evidence/postscript-$pass.log" 2>&1
|
||||
rc=$?
|
||||
echo "$rc" > "$XCAT_SYSLOG_FIXTURE/evidence/postscript-$pass.rc"
|
||||
[ "$rc" -eq 0 ] || break
|
||||
done
|
||||
chroot "$root" /usr/sbin/rsyslogd -N1 -f /etc/rsyslog.conf > "$XCAT_SYSLOG_FIXTURE/evidence/parser.log" 2>&1
|
||||
echo "$?" > "$XCAT_SYSLOG_FIXTURE/evidence/parser.rc"
|
||||
exit 0
|
||||
SH
|
||||
chmod 0755, "$tmp/bin/$_" for qw(systemctl logger run);
|
||||
my $minimal = "global(workDirectory=\"/var/lib/rsyslog\")\ninclude(file=\"/etc/rsyslog.d/*.conf\" mode=\"optional\")\n*.info /var/log/messages\n";
|
||||
for my $case (['mn', 0], ['snlocal', 0], ['snforward', 0], ['cn', 0], ['mn', 1], ['cn', 1]) {
|
||||
my ($role, $invalid) = @$case;
|
||||
my $name = "$role " . ($invalid ? 'invalid' : 'valid') . ' native chroot';
|
||||
my $fixture = "$tmp/$role-$invalid";
|
||||
make_path("$fixture/evidence", map { "$fixture/root/$_" }
|
||||
qw(usr bin sbin lib lib64 postscripts evidence proc dev run tmp etc/rsyslog.d var/log var/lib/rsyslog));
|
||||
copy('/etc/ld.so.cache', "$fixture/root/etc/ld.so.cache") or die $!;
|
||||
write_file("$fixture/root/etc/os-release", "ID=openEuler\n");
|
||||
write_file("$fixture/root/etc/xCATMN", '') if $role eq 'mn';
|
||||
write_file("$fixture/root/etc/rsyslog.conf", $minimal . ($invalid ? "invalid_rsyslog_directive()\n" : ''));
|
||||
local %ENV = (%ENV, XCAT_SYSLOG_FIXTURE => $fixture, XCAT_SYSLOG_BIN => "$tmp/bin",
|
||||
OSVER => ($ENV{XCAT_SYSLOG_OSVER} || 'openeuler24.03'), NTYPE => ($role =~ /^sn/ ? 'service' : 'compute'),
|
||||
SVLOGLOCAL => ($role eq 'snlocal' ? 1 : 0), MASTER => '127.0.0.1:1514', SYSLOG => '');
|
||||
is(system('unshare', '-mn', '--', "$tmp/bin/run"), 0, "$name: isolated driver completed");
|
||||
my $evidence = "$fixture/evidence";
|
||||
is(read_file("$evidence/detect.rc"), "0\n", "$name: native helper detects the actual chroot");
|
||||
is(read_file("$evidence/systemctl-baseline.rc"), "0\n", "$name: actual systemctl defers successfully");
|
||||
like(read_file("$evidence/systemctl-baseline.log"), qr/Running in chroot,\s*ignoring/i,
|
||||
"$name: native systemctl identifies service deferral");
|
||||
is(read_file("$evidence/helper.rc"), "1\n", "$name: shared restart helper retains its existing contract");
|
||||
is(read_file("$evidence/services-postscript.log"), '', "$name: postscript does not attempt service activation");
|
||||
if ($invalid) {
|
||||
isnt(read_file("$evidence/postscript-1.rc"), "0\n", "$name: parser failure reaches the postscript exit");
|
||||
isnt(read_file("$evidence/parser.rc"), "0\n", "$name: actual native parser rejects the configuration");
|
||||
is(read_file("$evidence/logger.log"), '', "$name: no success log follows invalid configuration");
|
||||
} else {
|
||||
is(read_file("$evidence/postscript-1.rc"), "0\n", "$name: configuration completes successfully");
|
||||
is(read_file("$evidence/postscript-2.rc"), "0\n", "$name: repeated configuration succeeds");
|
||||
is(read_file("$evidence/parser.rc"), "0\n", "$name: actual native parser accepts the result");
|
||||
like(read_file("$evidence/logger.log"), qr/rsyslog version 8 setup/, "$name: completed configuration is logged");
|
||||
}
|
||||
}
|
||||
done_testing();
|
||||
Reference in New Issue
Block a user